Subprocessors

In force

Every third party that touches your data, and what each one does.

In force since 7 October 2026 · version dbaf4c18

A subprocessor is a company we use to deliver the hosted Hearthmoot service that may process personal data on our behalf. This is the complete list.

We give at least 30 days' notice by email before we add or replace a subprocessor. If you object on reasonable data-protection grounds you may terminate without penalty and get a pro-rata refund. See Data Processing Agreement §6.

Last updated: 2026-10-07.

Current subprocessors

Subprocessor	What it does for us	Data it may process	Where processing happens
Hetzner Online GmbH (Germany)	Hosting, compute, storage, backups. This is where your tenant actually runs.	All tenant content and account data, at rest and in transit on their infrastructure	Helsinki, Finland
Functional Software, Inc. — Sentry, EU region	Error reporting when the software fails	Stack traces and request context, which can incidentally include a URL or identifier	EU region
Resend, Inc. (EU region)	Transactional email: receipts, password recovery, waitlist and capacity notices, service and subprocessor notices	Your account email address and message content	EU region (selected at setup)
Better Stack, Inc. (United States)	Uptime monitoring of our own public addresses, the alerts that go to our operator, and the public status page at hearthmoot.betteruptime.com	No tenant content and no customer personal data. It polls three addresses of ours from the outside and records whether each answered. The health endpoint it reads is deliberately one word — "ok" or "degraded" — with no campaign names, no counts and no numbers of any kind, so there is nothing about you in what it sees. The only personal data involved is our own operator's alert email address	United States, under the EU Standard Contractual Clauses in their published DPA
Cloudflare, Inc.	DNS, CDN and reverse proxy (full tunnel with proxying enabled)	IP addresses and request metadata in transit	Global edge network; origin stays EEA
Google Ireland Ltd — Google Workspace	Business mailbox: the support and role addresses (support@, privacy@, abuse@)	Email content and metadata of anyone who writes to those addresses	Stored in Europe (Google Workspace data regions); any processing outside Europe is under Google's SCCs. Tenant content never touches this system

Not a subprocessor

Paddle.com Market Ltd is our merchant of record and an independent controller for payment data. Paddle sells the subscription to you, takes the payment, and handles tax and invoicing. It does not process personal data on our instructions, so it is not a subprocessor and does not appear in the table above. We never receive or store your card details. Paddle's own privacy policy governs that processing.

We list it here anyway, because leaving out the company that takes your money would be the kind of technically-correct omission that erodes trust.

Data residency

Tenant data is stored in the EEA. Hosting is in Finland (Helsinki); error reporting is Sentry's EU region. We chose this so that your stored campaign data has no international transfer to manage, rather than managing one with contractual mechanisms.

Cloudflare's edge network is global by nature. With proxying enabled, request metadata transits non-EEA edge nodes; the origin, and everything stored, stays in the EEA.

Better Stack is the one entry in the United States, and it never sees your data: it asks three of our own addresses whether they are answering, and the health endpoint it reads was deliberately built to say one word rather than report on the fleet. Transfers are covered by the EU Standard Contractual Clauses in their DPA.

Paddle runs its own transfer arrangements as an independent controller.

Change history

Date	Change
2026-09-30	Initial list published
2026-10-02	Anthropic, PBC added (it was already in use and missing from the list). Hetzner's location corrected to Helsinki only. No customer was subscribed, so no notice was due
2026-10-07	Anthropic, PBC removed: our operator's AI assistant no longer reads support email or customer data, so Anthropic processes nothing on your behalf. Google Workspace now stores the mailbox in Europe (data regions)

Every future change gets a row here, with the notice date, so customers can see what changed and when.

Version: 1.2. Date: 2026-10-07.

Version history

This version has been in force since 7 October 2026 (version dbaf4c18).

What changed in this version

@@ -5,7 +5,7 @@ personal data on our behalf. This is the complete list.
 object on reasonable data-protection grounds you may terminate without penalty and get a
 pro-rata refund. See `DPA.md` §6.
 
-*Last updated: 2026-10-02.*
+*Last updated: 2026-10-07.*
 
 ## Current subprocessors
 
@@ -16,8 +16,7 @@ pro-rata refund. See `DPA.md` §6.
 | **Resend, Inc.** (EU region) | Transactional email: receipts, password recovery, waitlist and capacity notices, service and subprocessor notices | Your account email address and message content | EU region (selected at setup) |
 | **Better Stack, Inc.** (United States) | Uptime monitoring of our own public addresses, the alerts that go to our operator, and the public status page at hearthmoot.betteruptime.com | **No tenant content and no customer personal data.** It polls three addresses of ours from the outside and records whether each answered. The health endpoint it reads is deliberately one word — "ok" or "degraded" — with no campaign names, no counts and no numbers of any kind, so there is nothing about you in what it sees. The only personal data involved is our own operator's alert email address | United States, under the EU Standard Contractual Clauses in their published DPA |
 | **Cloudflare, Inc.** | DNS, CDN and reverse proxy (full tunnel with proxying enabled) | IP addresses and request metadata in transit | Global edge network; origin stays EEA |
-| **Google Ireland Ltd — Google Workspace** | Business mailbox: the support and role addresses (support@, privacy@, abuse@) | Email content and metadata of anyone who writes to those addresses | Global under Google's SCCs (no EU data-region pinning on the current plan); tenant content never touches this system |
-| **Anthropic, PBC** (United States) | The AI assistant (Claude) our operator uses to answer support email and to run, repair and back up the Service | What that work reads: the content of support email, and, while it works on our servers, tenant content and account data. Nothing is stored there for us, and it is not used to train models | United States, under the EU Standard Contractual Clauses in Anthropic's data processing terms |
+| **Google Ireland Ltd — Google Workspace** | Business mailbox: the support and role addresses (support@, privacy@, abuse@) | Email content and metadata of anyone who writes to those addresses | Stored in Europe (Google Workspace data regions); any processing outside Europe is under Google's SCCs. Tenant content never touches this system |
 
 ## Not a subprocessor
 
@@ -39,10 +38,7 @@ to manage, rather than managing one with contractual mechanisms.
 Cloudflare's edge network is global by nature. With proxying enabled, request metadata transits
 non-EEA edge nodes; the origin, and everything stored, stays in the EEA.
 
-Two entries are in the United States. Anthropic processes what our operator's AI assistant reads
-while it works, which can include your campaign data; nothing is stored there for us, and the
-transfer is covered by the EU Standard Contractual Clauses in Anthropic's data processing terms.
-Better Stack never sees your data: it asks three of our own addresses whether they are
+Better Stack is the one entry in the United States, and it never sees your data: it asks three of our own addresses whether they are
 answering, and the health endpoint it reads was deliberately built to say one word rather than
 report on the fleet. Transfers are covered by the EU Standard Contractual Clauses in their DPA.
 
@@ -54,10 +50,11 @@ Paddle runs its own transfer arrangements as an independent controller.
 |---|---|
 | 2026-09-30 | Initial list published |
 | 2026-10-02 | Anthropic, PBC added (it was already in use and missing from the list). Hetzner's location corrected to Helsinki only. No customer was subscribed, so no notice was due |
+| 2026-10-07 | Anthropic, PBC removed: our operator's AI assistant no longer reads support email or customer data, so Anthropic processes nothing on your behalf. Google Workspace now stores the mailbox in Europe (data regions) |
 
 *Every future change gets a row here, with the notice date, so customers can see what changed and
 when.*
 
 ---
 
-*Version: 1.1. Date: 2026-10-02.*
+*Version: 1.2. Date: 2026-10-07.*

The version of 2 October 2026 (bddbc6e1)

What changed in that version

@@ -5,18 +5,19 @@ personal data on our behalf. This is the complete list.
 object on reasonable data-protection grounds you may terminate without penalty and get a
 pro-rata refund. See `DPA.md` §6.
 
-*Last updated: 2026-09-30.*
+*Last updated: 2026-10-02.*
 
 ## Current subprocessors
 
 | Subprocessor | What it does for us | Data it may process | Where processing happens |
 |---|---|---|---|
-| **Hetzner Online GmbH** (Germany) | Hosting, compute, storage, backups. This is where your tenant actually runs. | All tenant content and account data, at rest and in transit on their infrastructure | Falkenstein, Germany · Helsinki, Finland |
+| **Hetzner Online GmbH** (Germany) | Hosting, compute, storage, backups. This is where your tenant actually runs. | All tenant content and account data, at rest and in transit on their infrastructure | Helsinki, Finland |
 | **Functional Software, Inc. — Sentry, EU region** | Error reporting when the software fails | Stack traces and request context, which can incidentally include a URL or identifier | EU region |
 | **Resend, Inc.** (EU region) | Transactional email: receipts, password recovery, waitlist and capacity notices, service and subprocessor notices | Your account email address and message content | EU region (selected at setup) |
 | **Better Stack, Inc.** (United States) | Uptime monitoring of our own public addresses, the alerts that go to our operator, and the public status page at hearthmoot.betteruptime.com | **No tenant content and no customer personal data.** It polls three addresses of ours from the outside and records whether each answered. The health endpoint it reads is deliberately one word — "ok" or "degraded" — with no campaign names, no counts and no numbers of any kind, so there is nothing about you in what it sees. The only personal data involved is our own operator's alert email address | United States, under the EU Standard Contractual Clauses in their published DPA |
 | **Cloudflare, Inc.** | DNS, CDN and reverse proxy (full tunnel with proxying enabled) | IP addresses and request metadata in transit | Global edge network; origin stays EEA |
 | **Google Ireland Ltd — Google Workspace** | Business mailbox: the support and role addresses (support@, privacy@, abuse@) | Email content and metadata of anyone who writes to those addresses | Global under Google's SCCs (no EU data-region pinning on the current plan); tenant content never touches this system |
+| **Anthropic, PBC** (United States) | The AI assistant (Claude) our operator uses to answer support email and to run, repair and back up the Service | What that work reads: the content of support email, and, while it works on our servers, tenant content and account data. Nothing is stored there for us, and it is not used to train models | United States, under the EU Standard Contractual Clauses in Anthropic's data processing terms |
 
 ## Not a subprocessor
 
@@ -31,15 +32,17 @@ of technically-correct omission that erodes trust.
 
 ## Data residency
 
-**Tenant data stays in the EEA.** Hosting is Germany and Finland; error reporting is Sentry's EU
-region. We chose this so that there is no international transfer to manage for your campaign
-data rather than managing one with contractual mechanisms.
+**Tenant data is stored in the EEA.** Hosting is in Finland (Helsinki); error reporting is
+Sentry's EU region. We chose this so that your stored campaign data has no international transfer
+to manage, rather than managing one with contractual mechanisms.
 
 Cloudflare's edge network is global by nature. With proxying enabled, request metadata transits
 non-EEA edge nodes; the origin, and everything stored, stays in the EEA.
 
-Better Stack is in the United States and is the one entry on this list that is not EEA-resident.
-It is also the one that never sees your data: it asks three of our own addresses whether they are
+Two entries are in the United States. Anthropic processes what our operator's AI assistant reads
+while it works, which can include your campaign data; nothing is stored there for us, and the
+transfer is covered by the EU Standard Contractual Clauses in Anthropic's data processing terms.
+Better Stack never sees your data: it asks three of our own addresses whether they are
 answering, and the health endpoint it reads was deliberately built to say one word rather than
 report on the fleet. Transfers are covered by the EU Standard Contractual Clauses in their DPA.
 
@@ -50,10 +53,11 @@ Paddle runs its own transfer arrangements as an independent controller.
 | Date | Change |
 |---|---|
 | 2026-09-30 | Initial list published |
+| 2026-10-02 | Anthropic, PBC added (it was already in use and missing from the list). Hetzner's location corrected to Helsinki only. No customer was subscribed, so no notice was due |
 
 *Every future change gets a row here, with the notice date, so customers can see what changed and
 when.*
 
 ---
 
-*Version: 1.0. Date: 2026-09-30.*
+*Version: 1.1. Date: 2026-10-02.*

A subprocessor is a company we use to deliver the hosted Hearthmoot service that may process personal data on our behalf. This is the complete list.

Last updated: 2026-10-02.

Current subprocessors

Subprocessor	What it does for us	Data it may process	Where processing happens
Hetzner Online GmbH (Germany)	Hosting, compute, storage, backups. This is where your tenant actually runs.	All tenant content and account data, at rest and in transit on their infrastructure	Helsinki, Finland
Functional Software, Inc. — Sentry, EU region	Error reporting when the software fails	Stack traces and request context, which can incidentally include a URL or identifier	EU region
Resend, Inc. (EU region)	Transactional email: receipts, password recovery, waitlist and capacity notices, service and subprocessor notices	Your account email address and message content	EU region (selected at setup)
Better Stack, Inc. (United States)	Uptime monitoring of our own public addresses, the alerts that go to our operator, and the public status page at hearthmoot.betteruptime.com	No tenant content and no customer personal data. It polls three addresses of ours from the outside and records whether each answered. The health endpoint it reads is deliberately one word — "ok" or "degraded" — with no campaign names, no counts and no numbers of any kind, so there is nothing about you in what it sees. The only personal data involved is our own operator's alert email address	United States, under the EU Standard Contractual Clauses in their published DPA
Cloudflare, Inc.	DNS, CDN and reverse proxy (full tunnel with proxying enabled)	IP addresses and request metadata in transit	Global edge network; origin stays EEA
Google Ireland Ltd — Google Workspace	Business mailbox: the support and role addresses (support@, privacy@, abuse@)	Email content and metadata of anyone who writes to those addresses	Global under Google's SCCs (no EU data-region pinning on the current plan); tenant content never touches this system
Anthropic, PBC (United States)	The AI assistant (Claude) our operator uses to answer support email and to run, repair and back up the Service	What that work reads: the content of support email, and, while it works on our servers, tenant content and account data. Nothing is stored there for us, and it is not used to train models	United States, under the EU Standard Contractual Clauses in Anthropic's data processing terms

Not a subprocessor

We list it here anyway, because leaving out the company that takes your money would be the kind of technically-correct omission that erodes trust.

Data residency

Cloudflare's edge network is global by nature. With proxying enabled, request metadata transits non-EEA edge nodes; the origin, and everything stored, stays in the EEA.

Two entries are in the United States. Anthropic processes what our operator's AI assistant reads while it works, which can include your campaign data; nothing is stored there for us, and the transfer is covered by the EU Standard Contractual Clauses in Anthropic's data processing terms. Better Stack never sees your data: it asks three of our own addresses whether they are answering, and the health endpoint it reads was deliberately built to say one word rather than report on the fleet. Transfers are covered by the EU Standard Contractual Clauses in their DPA.

Paddle runs its own transfer arrangements as an independent controller.

Change history

Date	Change
2026-09-30	Initial list published
2026-10-02	Anthropic, PBC added (it was already in use and missing from the list). Hetzner's location corrected to Helsinki only. No customer was subscribed, so no notice was due

Every future change gets a row here, with the notice date, so customers can see what changed and when.

Version: 1.1. Date: 2026-10-02.

The version of 30 September 2026 (57c5c420)

The first version to be in force.

A subprocessor is a company we use to deliver the hosted Hearthmoot service that may process personal data on our behalf. This is the complete list.

Last updated: 2026-09-30.

Current subprocessors

Subprocessor	What it does for us	Data it may process	Where processing happens
Hetzner Online GmbH (Germany)	Hosting, compute, storage, backups. This is where your tenant actually runs.	All tenant content and account data, at rest and in transit on their infrastructure	Falkenstein, Germany · Helsinki, Finland
Functional Software, Inc. — Sentry, EU region	Error reporting when the software fails	Stack traces and request context, which can incidentally include a URL or identifier	EU region
Resend, Inc. (EU region)	Transactional email: receipts, password recovery, waitlist and capacity notices, service and subprocessor notices	Your account email address and message content	EU region (selected at setup)
Better Stack, Inc. (United States)	Uptime monitoring of our own public addresses, the alerts that go to our operator, and the public status page at hearthmoot.betteruptime.com	No tenant content and no customer personal data. It polls three addresses of ours from the outside and records whether each answered. The health endpoint it reads is deliberately one word — "ok" or "degraded" — with no campaign names, no counts and no numbers of any kind, so there is nothing about you in what it sees. The only personal data involved is our own operator's alert email address	United States, under the EU Standard Contractual Clauses in their published DPA
Cloudflare, Inc.	DNS, CDN and reverse proxy (full tunnel with proxying enabled)	IP addresses and request metadata in transit	Global edge network; origin stays EEA
Google Ireland Ltd — Google Workspace	Business mailbox: the support and role addresses (support@, privacy@, abuse@)	Email content and metadata of anyone who writes to those addresses	Global under Google's SCCs (no EU data-region pinning on the current plan); tenant content never touches this system

Not a subprocessor

We list it here anyway, because leaving out the company that takes your money would be the kind of technically-correct omission that erodes trust.

Data residency

Tenant data stays in the EEA. Hosting is Germany and Finland; error reporting is Sentry's EU region. We chose this so that there is no international transfer to manage for your campaign data rather than managing one with contractual mechanisms.

Cloudflare's edge network is global by nature. With proxying enabled, request metadata transits non-EEA edge nodes; the origin, and everything stored, stays in the EEA.

Better Stack is in the United States and is the one entry on this list that is not EEA-resident. It is also the one that never sees your data: it asks three of our own addresses whether they are answering, and the health endpoint it reads was deliberately built to say one word rather than report on the fleet. Transfers are covered by the EU Standard Contractual Clauses in their DPA.

Paddle runs its own transfer arrangements as an independent controller.

Change history

Date	Change
2026-09-30	Initial list published

Every future change gets a row here, with the notice date, so customers can see what changed and when.

Version: 1.0. Date: 2026-09-30.